@prosopo/provider 4.15.16 → 5.0.0

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/provider@4.15.16 build
+> @prosopo/provider@5.0.0 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/provider@4.15.16 build:cross-env
+> @prosopo/provider@5.0.0 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -57,109 +57,110 @@ ViteEsmConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 98 modules transformed.
+✓ 99 modules transformed.
 rendering chunks...
 computing gzip size...
-dist/_virtual/_rolldown/runtime.js                                        0.04 kB │ gzip: 0.06 kB
-dist/tasks/index.js                                                       0.05 kB │ gzip: 0.06 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge.js                       0.11 kB │ gzip: 0.10 kB
-dist/api/admin/createApiAdminRoutesProvider.js                            0.35 kB │ gzip: 0.18 kB
-dist/api/robotsMiddleware.js                                              0.36 kB │ gzip: 0.24 kB
-dist/tasks/puzzleCaptcha/puzzleTasksUtils.js                              0.37 kB │ gzip: 0.24 kB
-dist/rules/lang.js                                                        0.39 kB │ gzip: 0.24 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/constants.js             0.40 kB │ gzip: 0.23 kB
-dist/api/ignoreMiddleware.js                                              0.41 kB │ gzip: 0.26 kB
-dist/api/ipInfoMiddleware.js                                              0.41 kB │ gzip: 0.26 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/decryptSimdReadings.js   0.51 kB │ gzip: 0.29 kB
-dist/utils/hashUserIp.js                                                  0.52 kB │ gzip: 0.33 kB
-dist/api/testSiteKey.js                                                   0.56 kB │ gzip: 0.30 kB
-dist/utils/hashUserAgent.js                                               0.63 kB │ gzip: 0.39 kB
-dist/api/validateAddress.js                                               0.70 kB │ gzip: 0.33 kB
-dist/utils/devicePlatform.js                                              0.74 kB │ gzip: 0.45 kB
-dist/api/block.js                                                         0.80 kB │ gzip: 0.36 kB
-dist/api/dnsEventUrl.js                                                   0.80 kB │ gzip: 0.44 kB
-dist/tasks/dataset/datasetTasks.js                                        0.85 kB │ gzip: 0.39 kB
-dist/tasks/frictionless/frictionlessTasksUtils.js                         0.87 kB │ gzip: 0.45 kB
-dist/tasks/powCaptcha/powTasksUtils.js                                    0.89 kB │ gzip: 0.46 kB
-dist/api/headerCheckMiddleware.js                                         0.91 kB │ gzip: 0.43 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/honeypotResponse.js      0.95 kB │ gzip: 0.51 kB
-dist/tasks/imgCaptcha/imgCaptchaTasksUtils.js                             0.96 kB │ gzip: 0.48 kB
-dist/api/admin/apiRegisterSiteKeyEndpoint.js                              1.00 kB │ gzip: 0.46 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/sessionDedup.js          1.01 kB │ gzip: 0.45 kB
-dist/api/admin/apiRemoveSiteKeysEndpoint.js                               1.07 kB │ gzip: 0.48 kB
-dist/api/admin/apiRegisterSiteKeysEndpoint.js                             1.08 kB │ gzip: 0.50 kB
-dist/api/admin/apiRemoveSiteKeyEndpoint.js                                1.08 kB │ gzip: 0.48 kB
-dist/api/captcha/contextAwareValidation.js                                1.09 kB │ gzip: 0.45 kB
-dist/api/admin/apiRemoveDetectorKeyEndpoint.js                            1.09 kB │ gzip: 0.49 kB
-dist/schedulers/captchaScheduler.js                                       1.11 kB │ gzip: 0.48 kB
-dist/utils/normalizeRequestIp.js                                          1.14 kB │ gzip: 0.52 kB
-dist/pairs.js                                                             1.19 kB │ gzip: 0.58 kB
-dist/schedulers/getClientList.js                                          1.19 kB │ gzip: 0.53 kB
-dist/schedulers/setClientEntropy.js                                       1.20 kB │ gzip: 0.52 kB
-dist/api/admin/apiUpdateDetectorKeyEndpoint.js                            1.20 kB │ gzip: 0.50 kB
-dist/api/admin/apiGetDecisionMachineEndpoint.js                           1.26 kB │ gzip: 0.50 kB
-dist/api/admin/apiRemoveAllDecisionMachinesEndpoint.js                    1.27 kB │ gzip: 0.51 kB
-dist/api/admin/apiRemoveDecisionMachineEndpoint.js                        1.29 kB │ gzip: 0.51 kB
-dist/tasks/detection/getBotScore.js                                       1.29 kB │ gzip: 0.47 kB
-dist/tasks/dataset/datasetTasksUtils.js                                   1.30 kB │ gzip: 0.48 kB
-dist/compositeIpAddress.js                                                1.36 kB │ gzip: 0.55 kB
-dist/api/admin/apiGetAllDecisionMachinesEndpoint.js                       1.48 kB │ gzip: 0.57 kB
-dist/schedulers/updateSpamEmailDomains.js                                 1.52 kB │ gzip: 0.60 kB
-dist/api/ja4Middleware.js                                                 1.59 kB │ gzip: 0.75 kB
-dist/utils/honeypot/encoders.js                                           1.62 kB │ gzip: 0.67 kB
-dist/api/admin/apiToggleMaintenanceModeEndpoint.js                        1.66 kB │ gzip: 0.69 kB
-dist/api/admin/apiUpdateDecisionMachineEndpoint.js                        1.68 kB │ gzip: 0.58 kB
-dist/utils/honeypot/phraseBank.js                                         1.69 kB │ gzip: 0.84 kB
-dist/api/handshakeTimingMiddleware.js                                     1.75 kB │ gzip: 0.69 kB
-dist/api/captcha/maintenanceModeResponses.js                              1.76 kB │ gzip: 0.57 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.js          1.87 kB │ gzip: 0.79 kB
-dist/tasks/spam/updateSpamEmailDomains.js                                 1.87 kB │ gzip: 0.77 kB
-dist/api/admin/apiClearAllCountersEndpoint.js                             1.89 kB │ gzip: 0.76 kB
-dist/api/public.js                                                        1.90 kB │ gzip: 0.83 kB
-dist/tasks/frictionless/routingMachine.js                                 2.16 kB │ gzip: 0.91 kB
-dist/utils/dns.js                                                         2.36 kB │ gzip: 0.95 kB
-dist/api/admin/apiDnsEventEndpoint.js                                     2.43 kB │ gzip: 0.96 kB
-dist/api/captcha/checkSpamEmail.js                                        2.47 kB │ gzip: 0.91 kB
-dist/api/captcha/submitPuzzleCaptchaSolution.js                           2.55 kB │ gzip: 0.96 kB
-dist/api/forwardVerify.js                                                 2.59 kB │ gzip: 1.10 kB
-dist/api/captcha/submitImageCaptchaSolution.js                            2.59 kB │ gzip: 1.00 kB
-dist/tasks/spam/evaluateEmailSpamRules.js                                 2.77 kB │ gzip: 1.20 kB
-dist/index.js                                                             2.78 kB │ gzip: 0.76 kB
-dist/api/admin/apiAdminRoutesProvider.js                                  2.84 kB │ gzip: 0.54 kB
-dist/api/domainMiddleware.js                                              3.52 kB │ gzip: 1.22 kB
-dist/api/captcha.js                                                       3.72 kB │ gzip: 1.21 kB
-dist/services/ipComparison.js                                             3.96 kB │ gzip: 1.19 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.js          3.99 kB │ gzip: 0.99 kB
-dist/api/hardBlockVerdictCache.js                                         4.08 kB │ gzip: 1.66 kB
-dist/tasks/spam/checkSpamEmail.js                                         4.12 kB │ gzip: 1.12 kB
-dist/tasks/dnsEvent/enrichDnsEvent.js                                     4.23 kB │ gzip: 1.50 kB
-dist/tasks/tasks.js                                                       4.69 kB │ gzip: 1.51 kB
-dist/api/captcha/getPoWCaptchaChallenge.js                                5.13 kB │ gzip: 1.61 kB
-dist/api/captcha/getPuzzleCaptchaChallenge.js                             5.35 kB │ gzip: 1.64 kB
-dist/api/captcha/getImageCaptchaChallenge.js                              5.39 kB │ gzip: 1.74 kB
-dist/tasks/spam/checkTrafficFilter.js                                     5.63 kB │ gzip: 2.05 kB
-dist/util/usageCounters.js                                                5.65 kB │ gzip: 2.01 kB
-dist/api/captcha/submitPoWCaptchaSolution.js                              6.16 kB │ gzip: 2.09 kB
-dist/api/metrics.js                                                       6.96 kB │ gzip: 2.09 kB
-dist/api/ja4.js                                                           7.06 kB │ gzip: 2.23 kB
-dist/api/startProviderApi.js                                              8.47 kB │ gzip: 2.81 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.js       8.91 kB │ gzip: 2.03 kB
-dist/tasks/decisionMachine/decisionMachineRunner.js                       9.40 kB │ gzip: 2.86 kB
-dist/api/blacklistRequestInspector.js                                    11.57 kB │ gzip: 4.19 kB
-dist/api/verify.js                                                       12.03 kB │ gzip: 2.44 kB
-dist/util.js                                                             12.92 kB │ gzip: 3.16 kB
-dist/tasks/client/clientTasks.js                                         13.21 kB │ gzip: 3.28 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js              13.94 kB │ gzip: 3.55 kB
-dist/tasks/frictionless/frictionlessTasks.js                             14.62 kB │ gzip: 3.94 kB
-dist/tasks/captchaManager.js                                             16.63 kB │ gzip: 4.85 kB
-dist/tasks/detection/decodeBehavior.js                                   17.15 kB │ gzip: 6.60 kB
-dist/tasks/puzzleCaptcha/puzzleTasks.js                                  17.94 kB │ gzip: 4.31 kB
-dist/tasks/detection/decodeSimd.js                                       19.34 kB │ gzip: 8.30 kB
-dist/tasks/powCaptcha/powTasks.js                                        20.18 kB │ gzip: 5.24 kB
-dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 23.90 kB │ gzip: 5.84 kB
-dist/tasks/detection/decodePayload.js                                    26.98 kB │ gzip: 9.17 kB
+dist/_virtual/_rolldown/runtime.js                                        0.04 kB │ gzip:  0.06 kB
+dist/tasks/index.js                                                       0.05 kB │ gzip:  0.06 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge.js                       0.11 kB │ gzip:  0.10 kB
+dist/api/admin/createApiAdminRoutesProvider.js                            0.35 kB │ gzip:  0.18 kB
+dist/api/robotsMiddleware.js                                              0.36 kB │ gzip:  0.24 kB
+dist/tasks/puzzleCaptcha/puzzleTasksUtils.js                              0.37 kB │ gzip:  0.24 kB
+dist/rules/lang.js                                                        0.39 kB │ gzip:  0.24 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/constants.js             0.40 kB │ gzip:  0.23 kB
+dist/api/ignoreMiddleware.js                                              0.41 kB │ gzip:  0.26 kB
+dist/api/ipInfoMiddleware.js                                              0.41 kB │ gzip:  0.26 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/decryptSimdReadings.js   0.51 kB │ gzip:  0.27 kB
+dist/utils/hashUserIp.js                                                  0.52 kB │ gzip:  0.33 kB
+dist/api/testSiteKey.js                                                   0.56 kB │ gzip:  0.30 kB
+dist/utils/hashUserAgent.js                                               0.63 kB │ gzip:  0.39 kB
+dist/api/validateAddress.js                                               0.70 kB │ gzip:  0.33 kB
+dist/utils/devicePlatform.js                                              0.74 kB │ gzip:  0.45 kB
+dist/tasks/frictionless/frictionlessTasksUtils.js                         0.79 kB │ gzip:  0.42 kB
+dist/api/block.js                                                         0.80 kB │ gzip:  0.36 kB
+dist/api/dnsEventUrl.js                                                   0.80 kB │ gzip:  0.44 kB
+dist/tasks/dataset/datasetTasks.js                                        0.85 kB │ gzip:  0.39 kB
+dist/tasks/powCaptcha/powTasksUtils.js                                    0.89 kB │ gzip:  0.46 kB
+dist/api/headerCheckMiddleware.js                                         0.91 kB │ gzip:  0.43 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/honeypotResponse.js      0.95 kB │ gzip:  0.51 kB
+dist/tasks/imgCaptcha/imgCaptchaTasksUtils.js                             0.96 kB │ gzip:  0.48 kB
+dist/api/admin/apiRegisterSiteKeyEndpoint.js                              1.00 kB │ gzip:  0.46 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/sessionDedup.js          1.01 kB │ gzip:  0.45 kB
+dist/api/admin/apiRemoveSiteKeysEndpoint.js                               1.07 kB │ gzip:  0.48 kB
+dist/api/admin/apiRegisterSiteKeysEndpoint.js                             1.08 kB │ gzip:  0.50 kB
+dist/api/admin/apiRemoveSiteKeyEndpoint.js                                1.08 kB │ gzip:  0.48 kB
+dist/api/captcha/contextAwareValidation.js                                1.09 kB │ gzip:  0.45 kB
+dist/schedulers/captchaScheduler.js                                       1.11 kB │ gzip:  0.48 kB
+dist/utils/normalizeRequestIp.js                                          1.14 kB │ gzip:  0.52 kB
+dist/pairs.js                                                             1.19 kB │ gzip:  0.58 kB
+dist/schedulers/getClientList.js                                          1.19 kB │ gzip:  0.53 kB
+dist/schedulers/setClientEntropy.js                                       1.20 kB │ gzip:  0.52 kB
+dist/api/admin/apiGetDecisionMachineEndpoint.js                           1.26 kB │ gzip:  0.50 kB
+dist/api/admin/apiRemoveAllDecisionMachinesEndpoint.js                    1.27 kB │ gzip:  0.51 kB
+dist/api/admin/apiRemoveDecisionMachineEndpoint.js                        1.29 kB │ gzip:  0.51 kB
+dist/tasks/dataset/datasetTasksUtils.js                                   1.30 kB │ gzip:  0.48 kB
+dist/tasks/detection/getBotScore.js                                       1.33 kB │ gzip:  0.49 kB
+dist/compositeIpAddress.js                                                1.36 kB │ gzip:  0.55 kB
+dist/api/admin/apiGetAllDecisionMachinesEndpoint.js                       1.48 kB │ gzip:  0.57 kB
+dist/schedulers/updateSpamEmailDomains.js                                 1.52 kB │ gzip:  0.60 kB
+dist/api/admin/apiReplaceDetectorPoolEndpoint.js                          1.57 kB │ gzip:  0.68 kB
+dist/api/ja4Middleware.js                                                 1.59 kB │ gzip:  0.75 kB
+dist/utils/honeypot/encoders.js                                           1.62 kB │ gzip:  0.67 kB
+dist/api/admin/apiToggleMaintenanceModeEndpoint.js                        1.66 kB │ gzip:  0.69 kB
+dist/api/admin/apiUpdateDecisionMachineEndpoint.js                        1.68 kB │ gzip:  0.58 kB
+dist/utils/honeypot/phraseBank.js                                         1.69 kB │ gzip:  0.84 kB
+dist/api/handshakeTimingMiddleware.js                                     1.75 kB │ gzip:  0.69 kB
+dist/api/captcha/maintenanceModeResponses.js                              1.76 kB │ gzip:  0.57 kB
+dist/tasks/spam/updateSpamEmailDomains.js                                 1.87 kB │ gzip:  0.77 kB
+dist/api/admin/apiClearAllCountersEndpoint.js                             1.89 kB │ gzip:  0.76 kB
+dist/api/public.js                                                        1.90 kB │ gzip:  0.83 kB
+dist/api/captcha/assignDetectorBundle.js                                  1.96 kB │ gzip:  0.87 kB
+dist/tasks/frictionless/routingMachine.js                                 2.16 kB │ gzip:  0.91 kB
+dist/utils/dns.js                                                         2.36 kB │ gzip:  0.95 kB
+dist/api/admin/apiDnsEventEndpoint.js                                     2.43 kB │ gzip:  0.96 kB
+dist/api/captcha/checkSpamEmail.js                                        2.47 kB │ gzip:  0.91 kB
+dist/api/captcha/submitPuzzleCaptchaSolution.js                           2.55 kB │ gzip:  0.96 kB
+dist/api/forwardVerify.js                                                 2.59 kB │ gzip:  1.10 kB
+dist/api/captcha/submitImageCaptchaSolution.js                            2.59 kB │ gzip:  1.00 kB
+dist/api/admin/apiAdminRoutesProvider.js                                  2.64 kB │ gzip:  0.53 kB
+dist/tasks/spam/evaluateEmailSpamRules.js                                 2.77 kB │ gzip:  1.20 kB
+dist/index.js                                                             2.78 kB │ gzip:  0.76 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.js          3.44 kB │ gzip:  1.40 kB
+dist/api/domainMiddleware.js                                              3.52 kB │ gzip:  1.22 kB
+dist/services/ipComparison.js                                             3.96 kB │ gzip:  1.19 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.js          3.99 kB │ gzip:  0.99 kB
+dist/api/captcha.js                                                       4.05 kB │ gzip:  1.31 kB
+dist/api/hardBlockVerdictCache.js                                         4.08 kB │ gzip:  1.66 kB
+dist/tasks/spam/checkSpamEmail.js                                         4.12 kB │ gzip:  1.12 kB
+dist/tasks/dnsEvent/enrichDnsEvent.js                                     4.23 kB │ gzip:  1.50 kB
+dist/tasks/tasks.js                                                       4.69 kB │ gzip:  1.51 kB
+dist/api/captcha/getPoWCaptchaChallenge.js                                5.26 kB │ gzip:  1.66 kB
+dist/api/captcha/getPuzzleCaptchaChallenge.js                             5.48 kB │ gzip:  1.69 kB
+dist/api/captcha/getImageCaptchaChallenge.js                              5.52 kB │ gzip:  1.78 kB
+dist/tasks/spam/checkTrafficFilter.js                                     5.63 kB │ gzip:  2.05 kB
+dist/util/usageCounters.js                                                5.65 kB │ gzip:  2.01 kB
+dist/api/captcha/submitPoWCaptchaSolution.js                              6.18 kB │ gzip:  2.09 kB
+dist/api/metrics.js                                                       6.96 kB │ gzip:  2.09 kB
+dist/api/ja4.js                                                           7.06 kB │ gzip:  2.23 kB
+dist/tasks/detection/bundlePool.js                                        8.30 kB │ gzip:  3.21 kB
+dist/api/startProviderApi.js                                              9.25 kB │ gzip:  3.14 kB
+dist/tasks/decisionMachine/decisionMachineRunner.js                       9.40 kB │ gzip:  2.86 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.js       9.41 kB │ gzip:  2.06 kB
+dist/api/blacklistRequestInspector.js                                    11.57 kB │ gzip:  4.19 kB
+dist/api/verify.js                                                       12.03 kB │ gzip:  2.44 kB
+dist/tasks/client/clientTasks.js                                         12.33 kB │ gzip:  3.07 kB
+dist/util.js                                                             12.92 kB │ gzip:  3.16 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js              14.35 kB │ gzip:  3.65 kB
+dist/tasks/frictionless/frictionlessTasks.js                             15.60 kB │ gzip:  4.28 kB
+dist/tasks/captchaManager.js                                             17.75 kB │ gzip:  5.17 kB
+dist/tasks/puzzleCaptcha/puzzleTasks.js                                  17.93 kB │ gzip:  4.28 kB
+dist/tasks/powCaptcha/powTasks.js                                        20.17 kB │ gzip:  5.21 kB
+dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 23.91 kB │ gzip:  5.83 kB
+dist/tasks/detection/decodeBehavior.js                                   32.26 kB │ gzip: 10.34 kB
+dist/tasks/detection/decodeSimd.js                                       36.06 kB │ gzip: 12.00 kB
+dist/tasks/detection/decodePayload.js                                    46.69 kB │ gzip: 14.66 kB
 
-✓ built in 166ms
+✓ built in 178ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeSimd.js

package/CHANGELOG.md

@@ -1,5 +1,113 @@
 # @prosopo/provider
 
+## 5.0.0
+### Major Changes
+
+- 787017b: chore(detector): remove the legacy detector-key rotation machinery
+  
+  Nothing has read these keys since the detector moved to per-session provider
+  bundles — the decrypt paths resolve a bundle's own keypair instead. Rotating
+  them was already a no-op, so the whole surface is removed rather than left
+  looking live.
+  
+  **Breaking — the admin API loses two endpoints:**
+  
+  - `POST /v1/prosopo/provider/admin/detector/update` (`AdminApiPaths.UpdateDetectorKey`)
+  - `POST /v1/prosopo/provider/admin/detector/remove` (`AdminApiPaths.RemoveDetectorKey`)
+  
+  Also removed: `ProviderApi.updateDetectorKey` / `.removeDetectorKey`;
+  `ClientTaskManager.updateDetectorKey` / `.removeDetectorKey`;
+  `IProviderDatabase.storeDetectorKey` / `.getDetectorKeys` / `.removeDetectorKey`;
+  the `detector` Mongo collection and its `DetectorRecordSchema` / `DetectorSchema`
+  / `DetectorKey` types; the `UpdateDetectorKeyBody` / `RemoveDetectorKeyBodySpec`
+  / `UpdateDetectorKeyResponse` API types; and the rate-limit config for both
+  paths.
+  
+  The `detector` collection itself is left in place on existing deployments — no
+  migration drops it. It can be dropped manually once the pool rollout is
+  confirmed.
+
+### Minor Changes
+
+- 787017b: feat(detector): serve the detector only from per-session provider bundles; PoW fallback
+  
+  The detector now lives ONLY in the provider-served, precomputed pool bundles — there is no detector bundled into the widget and no legacy detector-key pool. Each session's bundle encrypts everything it produces (bot score, SIMD readings, behavioural data) with its own RSA keypair + inner ChaCha20-Poly1305 cipher; the provider decrypts each payload with that exact bundle, resolved per session.
+  
+  - `DetectorBundlePool`: loads precomputed `{id}.js`/`{id}.json` bundle pairs from disk, uniform-random per-session selection, hot-swap `replace()` for the admin push channel.
+  - The pool is ALWAYS initialised at boot (a missing/empty dir yields an empty pool), collapsing the old three states into two: bundles present ⇒ per-session serving; no bundles ⇒ always PoW.
+  - Redis short-TTL `detectorSessionId → bundleId` binding; the resolved `bundleId` is promoted onto the durable session record so later hops (SIMD attach, PoW/puzzle/image solution submit) decrypt with the same bundle.
+  - Client: removed the inlined `@prosopo/detector` runtime import (now type-only). When no provider bundle can be obtained/run, the client signals `detectorUnavailable` and the provider serves a PoW challenge.
+  - All server decrypt paths (score, SIMD readings, behavioural data) resolve the session's bundle and pass its inner cipher; the legacy key-pool brute force and its env fallback are removed from the detection paths. Decrypt failures fail closed (treated as bot ⇒ PoW).
+- 787017b: feat(detector-pool): persist pushed pools, stamp releases, fix the failed-decrypt path
+  
+  - `ReplaceDetectorPool` gets a dedicated 128 MB body limit (~86 MB for a
+    100-bundle pool); every other route keeps the 1 MB backstop.
+  - A pushed pool is now written to the pool directory (staged + renamed) so it
+    survives a restart instead of living only in process memory. The response
+    reports `persisted` so an unpersisted push can be alarmed on. The provider
+    containers gain a host-mounted volume for it — the pool is never baked into
+    the image, which is public on Docker Hub.
+  - Bundles carry the release they were built from; providers skip bundles from
+    another release (`PROSOPO_DETECTOR_POOL_RELEASE`). The widget carries no
+    detector of its own, so nothing else tied the two together.
+  - Failed decryption is now its own decision (`DECRYPTION_FAILED`, 3 image
+    rounds) evaluated before every other check. Previously the synthetic
+    `userAgent: undefined` / `baseBotScore: 1` / `timestamp: 0` that
+    `decryptPayload` substitutes made these sessions land in USER_AGENT_MISMATCH
+    (6 rounds), or a 401 on sitekeys with `autoBanScoreThreshold` set.
+    `timestampDecayFunction` loses its now-unreachable `decryptionFailed` arm.
+
+### Patch Changes
+
+- 787017b: perf(caddy): compress proxied provider responses with zstd/gzip
+  
+  `docker/provider.Caddyfile` had no `encode` directive, and Caddy does not
+  compress by default, so every proxied response went out uncompressed. The
+  detector-pool bundle makes that expensive: ~830 KB of obfuscated JS returned
+  inline from `/detector/assign` once per frictionless session.
+  
+  Obfuscated output still compresses well (the obfuscator's string-array encoding
+  is highly repetitive) — 2.6x with gzip, 3.1x with zstd. At 15k sessions/hour a
+  single provider drops from ~9.15 TB/month of egress to ~3 TB.
+  
+  zstd is preferred with gzip as the fallback. Responses below `minimum_length`
+  (512 bytes) are untouched, which covers every small JSON reply the API returns.
+- 787017b: fix(detector-pool): persist into the pool directory instead of replacing it
+  
+  The previous stage-and-rename persist was destructive against the provider's
+  bind-mounted pool directory: it deleted the mount's contents and then failed
+  with EBUSY renaming over the mount point, wiping the on-disk pool while still
+  reporting the push as successful. Now writes each bundle via a per-file temp +
+  rename within the directory and prunes removed bundles, never touching the
+  directory itself.
+- Updated dependencies [787017b]
+- Updated dependencies [787017b]
+- Updated dependencies [787017b]
+- Updated dependencies [d107d65]
+- Updated dependencies [6f19cde]
+  - @prosopo/database@4.0.0
+  - @prosopo/types@5.0.0
+  - @prosopo/types-database@5.0.0
+  - @prosopo/api@4.0.0
+  - @prosopo/api-express-router@3.1.54
+  - @prosopo/datasets@3.1.56
+  - @prosopo/env@3.6.23
+  - @prosopo/ipinfo@0.3.1
+  - @prosopo/keyring@2.9.63
+  - @prosopo/load-balancer@2.10.17
+  - @prosopo/types-env@2.10.20
+  - @prosopo/user-access-policy@3.12.11
+
+## 4.15.17
+### Patch Changes
+
+- a66273a: Populate `userScope.headHash` from the frictionless session record in the three captcha-challenge endpoints (`getPoWCaptchaChallenge`, `getImageCaptchaChallenge`, `getPuzzleCaptchaChallenge`). Previously all three hardcoded `undefined` for the headHash slot, so access-policy rules keyed on `headHash` could only take effect at server-verify time — after the challenge was already issued at the client-configured type / difficulty. With `sessionId` in hand each endpoint now does one indexed `getSessionRecordBySessionId` lookup and forwards `sessionRecord?.decryptedHeadHash` into `getRequestUserScope`, so headHash rules can restrict or adjust the challenge at issuance. No change when the request omits `sessionId` (direct-pow etc.).
+- Updated dependencies [71a5952]
+  - @prosopo/keyring@2.9.62
+  - @prosopo/env@3.6.22
+  - @prosopo/types-env@2.10.19
+  - @prosopo/api-express-router@3.1.53
+
 ## 4.15.16
 ### Patch Changes
 

package/dist/api/admin/apiAdminRoutesProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiAdminRoutesProvider.d.ts","sourceRoot":"","sources":["../../../src/api/admin/apiAdminRoutesProvider.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAgBlD,cAAM,sBAAuB,YAAW,iBAAiB;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,KAAK;IAEzC,SAAS,IAAI,SAAS;CA0C7B;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"apiAdminRoutesProvider.d.ts","sourceRoot":"","sources":["../../../src/api/admin/apiAdminRoutesProvider.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAelD,cAAM,sBAAuB,YAAW,iBAAiB;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,KAAK;IAEzC,SAAS,IAAI,SAAS;CAqC7B;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/api/admin/apiAdminRoutesProvider.js

@@ -7,11 +7,10 @@ import { ApiRegisterSiteKeyEndpoint } from "./apiRegisterSiteKeyEndpoint.js";
 import { ApiRegisterSiteKeysEndpoint } from "./apiRegisterSiteKeysEndpoint.js";
 import { ApiRemoveAllDecisionMachinesEndpoint } from "./apiRemoveAllDecisionMachinesEndpoint.js";
 import { ApiRemoveDecisionMachineEndpoint } from "./apiRemoveDecisionMachineEndpoint.js";
-import { ApiRemoveDetectorKeyEndpoint } from "./apiRemoveDetectorKeyEndpoint.js";
 import { ApiRemoveSiteKeyEndpoint } from "./apiRemoveSiteKeyEndpoint.js";
 import { ApiRemoveSiteKeysEndpoint } from "./apiRemoveSiteKeysEndpoint.js";
+import { ApiReplaceDetectorPoolEndpoint } from "./apiReplaceDetectorPoolEndpoint.js";
 import { ApiUpdateDecisionMachineEndpoint } from "./apiUpdateDecisionMachineEndpoint.js";
-import { ApiUpdateDetectorKeyEndpoint } from "./apiUpdateDetectorKeyEndpoint.js";
 import { AdminApiPaths } from "@prosopo/types";
 //#region src/api/admin/apiAdminRoutesProvider.ts
 var ApiAdminRoutesProvider = class {
@@ -22,8 +21,6 @@ var ApiAdminRoutesProvider = class {
 		return {
 			[AdminApiPaths.SiteKeyRegister]: new ApiRegisterSiteKeyEndpoint(this.tasks.clientTaskManager),
 			[AdminApiPaths.SiteKeysRegister]: new ApiRegisterSiteKeysEndpoint(this.tasks.clientTaskManager),
-			[AdminApiPaths.UpdateDetectorKey]: new ApiUpdateDetectorKeyEndpoint(this.tasks.clientTaskManager),
-			[AdminApiPaths.RemoveDetectorKey]: new ApiRemoveDetectorKeyEndpoint(this.tasks.clientTaskManager),
 			[AdminApiPaths.UpdateDecisionMachine]: new ApiUpdateDecisionMachineEndpoint(this.tasks.clientTaskManager),
 			[AdminApiPaths.GetAllDecisionMachines]: new ApiGetAllDecisionMachinesEndpoint(this.tasks.clientTaskManager),
 			[AdminApiPaths.GetDecisionMachine]: new ApiGetDecisionMachineEndpoint(this.tasks.clientTaskManager),
@@ -33,7 +30,8 @@ var ApiAdminRoutesProvider = class {
 			[AdminApiPaths.SiteKeyRemove]: new ApiRemoveSiteKeyEndpoint(this.tasks.clientTaskManager),
 			[AdminApiPaths.SiteKeysRemove]: new ApiRemoveSiteKeysEndpoint(this.tasks.clientTaskManager),
 			[AdminApiPaths.ToggleMaintenanceMode]: new ApiToggleMaintenanceModeEndpoint(),
-			[AdminApiPaths.DnsEvent]: new ApiDnsEventEndpoint(this.tasks.db, this.tasks.env.ipInfoService)
+			[AdminApiPaths.DnsEvent]: new ApiDnsEventEndpoint(this.tasks.db, this.tasks.env.ipInfoService),
+			[AdminApiPaths.ReplaceDetectorPool]: new ApiReplaceDetectorPoolEndpoint()
 		};
 	}
 };

package/dist/api/admin/apiAdminRoutesProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiAdminRoutesProvider.js","sourceRoot":"","sources":["../../../src/api/admin/apiAdminRoutesProvider.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,oCAAoC,EAAE,MAAM,2CAA2C,CAAC;AACjG,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAEjF,MAAM,sBAAsB;IAC3B,YAAoC,KAAY;QAAZ,UAAK,GAAL,KAAK,CAAO;IAAG,CAAC;IAE7C,SAAS;QACf,OAAO;YACN,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,IAAI,0BAA0B,CAC9D,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,IAAI,2BAA2B,CAChE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,IAAI,4BAA4B,CAClE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,IAAI,4BAA4B,CAClE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EACpC,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACnE,CAAC,aAAa,CAAC,sBAAsB,CAAC,EACrC,IAAI,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACpE,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,IAAI,6BAA6B,CACpE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EACpC,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACnE,CAAC,aAAa,CAAC,yBAAyB,CAAC,EACxC,IAAI,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvE,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,IAAI,2BAA2B,CAChE,IAAI,CAAC,KAAK,CAAC,aAAa,CACxB;YACD,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,IAAI,wBAAwB,CAC1D,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,IAAI,yBAAyB,CAC5D,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EACpC,IAAI,gCAAgC,EAAE;YACvC,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,mBAAmB,CAChD,IAAI,CAAC,KAAK,CAAC,EAAE,EACb,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAC5B;SACD,CAAC;IACH,CAAC;CACD;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"apiAdminRoutesProvider.js","sourceRoot":"","sources":["../../../src/api/admin/apiAdminRoutesProvider.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,oCAAoC,EAAE,MAAM,2CAA2C,CAAC;AACjG,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAEzF,MAAM,sBAAsB;IAC3B,YAAoC,KAAY;QAAZ,UAAK,GAAL,KAAK,CAAO;IAAG,CAAC;IAE7C,SAAS;QACf,OAAO;YACN,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,IAAI,0BAA0B,CAC9D,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,IAAI,2BAA2B,CAChE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EACpC,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACnE,CAAC,aAAa,CAAC,sBAAsB,CAAC,EACrC,IAAI,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACpE,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,IAAI,6BAA6B,CACpE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EACpC,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACnE,CAAC,aAAa,CAAC,yBAAyB,CAAC,EACxC,IAAI,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvE,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,IAAI,2BAA2B,CAChE,IAAI,CAAC,KAAK,CAAC,aAAa,CACxB;YACD,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,IAAI,wBAAwB,CAC1D,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,IAAI,yBAAyB,CAC5D,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EACpC,IAAI,gCAAgC,EAAE;YACvC,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,mBAAmB,CAChD,IAAI,CAAC,KAAK,CAAC,EAAE,EACb,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAC5B;YACD,CAAC,aAAa,CAAC,mBAAmB,CAAC,EAAE,IAAI,8BAA8B,EAAE;SACzE,CAAC;IACH,CAAC;CACD;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/api/admin/apiReplaceDetectorPoolEndpoint.d.ts

@@ -0,0 +1,11 @@
+import { type ApiEndpoint, type ApiEndpointResponse } from "@prosopo/api-route";
+import { type Logger } from "@prosopo/logger";
+import { ReplaceDetectorPoolBody } from "@prosopo/types";
+import type { z } from "zod";
+type ReplaceDetectorPoolBodyType = typeof ReplaceDetectorPoolBody;
+declare class ApiReplaceDetectorPoolEndpoint implements ApiEndpoint<ReplaceDetectorPoolBodyType> {
+    processRequest(args: z.infer<ReplaceDetectorPoolBodyType>, logger?: Logger): Promise<ApiEndpointResponse>;
+    getRequestArgsSchema(): ReplaceDetectorPoolBodyType;
+}
+export { ApiReplaceDetectorPoolEndpoint };
+//# sourceMappingURL=apiReplaceDetectorPoolEndpoint.d.ts.map

package/dist/api/admin/apiReplaceDetectorPoolEndpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiReplaceDetectorPoolEndpoint.d.ts","sourceRoot":"","sources":["../../../src/api/admin/apiReplaceDetectorPoolEndpoint.ts"],"names":[],"mappings":"AAcA,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,mBAAmB,EAExB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAM7B,KAAK,2BAA2B,GAAG,OAAO,uBAAuB,CAAC;AAQlE,cAAM,8BACL,YAAW,WAAW,CAAC,2BAA2B,CAAC;IAE7C,cAAc,CACnB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAC1C,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;IAiCxB,oBAAoB,IAAI,2BAA2B;CAG1D;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC"}

package/dist/api/admin/apiReplaceDetectorPoolEndpoint.js

@@ -0,0 +1,56 @@
+import { replaceDetectorBundlePool } from "../../tasks/detection/bundlePool.js";
+import { getLogger } from "@prosopo/logger";
+import { ReplaceDetectorPoolBody } from "@prosopo/types";
+import { ApiEndpointResponseStatus } from "@prosopo/api-route";
+//#region src/api/admin/apiReplaceDetectorPoolEndpoint.ts
+/**
+* Hot-swaps the in-memory detector bundle pool with a freshly-pushed set of
+* bundles. The emergency rotation channel — lets the cycle script swap the pool
+* without a provider redeploy. Bundles never touch disk here; they live only in
+* process memory.
+*/
+var ApiReplaceDetectorPoolEndpoint = class {
+	async processRequest(args, logger) {
+		logger = logger || getLogger("info", "");
+		try {
+			const bundles = new Map(Object.entries(args.bundles));
+			const activeLogger = logger;
+			const { count, persisted } = replaceDetectorBundlePool(bundles, {
+				warn: (msg, data) => activeLogger.warn(() => ({
+					msg,
+					data
+				})),
+				info: (msg, data) => activeLogger.info(() => ({
+					msg,
+					data
+				}))
+			});
+			logger.info(() => ({
+				msg: "Detector bundle pool replaced",
+				count,
+				persisted
+			}));
+			return {
+				status: ApiEndpointResponseStatus.SUCCESS,
+				data: {
+					count,
+					persisted
+				}
+			};
+		} catch (error) {
+			logger.error(() => ({
+				msg: "Error replacing detector bundle pool",
+				err: error
+			}));
+			return {
+				status: ApiEndpointResponseStatus.FAIL,
+				error: error.message
+			};
+		}
+	}
+	getRequestArgsSchema() {
+		return ReplaceDetectorPoolBody;
+	}
+};
+//#endregion
+export { ApiReplaceDetectorPoolEndpoint };

package/dist/api/admin/apiReplaceDetectorPoolEndpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiReplaceDetectorPoolEndpoint.js","sourceRoot":"","sources":["../../../src/api/admin/apiReplaceDetectorPoolEndpoint.ts"],"names":[],"mappings":"AAcA,OAAO,EAGN,yBAAyB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAe,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,EAEN,yBAAyB,GACzB,MAAM,qCAAqC,CAAC;AAU7C,MAAM,8BAA8B;IAGnC,KAAK,CAAC,cAAc,CACnB,IAA0C,EAC1C,MAAe;QAEf,MAAM,GAAG,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,IAAI,GAAG,CAAqB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1E,MAAM,YAAY,GAAG,MAAM,CAAC;YAC5B,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,yBAAyB,CAAC,OAAO,EAAE;gBAC/D,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7D,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;aAC7D,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAClB,GAAG,EAAE,+BAA+B;gBACpC,KAAK;gBAIL,SAAS;aACT,CAAC,CAAC,CAAC;YACJ,OAAO;gBACN,MAAM,EAAE,yBAAyB,CAAC,OAAO;gBACzC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;aAC1B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnB,GAAG,EAAE,sCAAsC;gBAC3C,GAAG,EAAE,KAAK;aACV,CAAC,CAAC,CAAC;YACJ,OAAO;gBACN,MAAM,EAAE,yBAAyB,CAAC,IAAI;gBACtC,KAAK,EAAG,KAAyB,CAAC,OAAO;aACzC,CAAC;QACH,CAAC;IACF,CAAC;IAEM,oBAAoB;QAC1B,OAAO,uBAAuB,CAAC;IAChC,CAAC;CACD;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC"}

package/dist/api/captcha/assignDetectorBundle.d.ts

@@ -0,0 +1,6 @@
+import type { ProviderEnvironment } from "@prosopo/types-env";
+import type { NextFunction, Request, Response } from "express";
+import type { AugmentedRequest } from "../../express.js";
+declare const _default: (env: ProviderEnvironment) => (req: Request & AugmentedRequest, res: Response, _next: NextFunction) => Promise<Response>;
+export default _default;
+//# sourceMappingURL=assignDetectorBundle.d.ts.map

package/dist/api/captcha/assignDetectorBundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignDetectorBundle.d.ts","sourceRoot":"","sources":["../../../src/api/captcha/assignDetectorBundle.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;8BAiBpC,mBAAmB,WAEjC,OAAO,GAAG,gBAAgB,OAC1B,QAAQ,SACN,YAAY,KACjB,OAAO,CAAC,QAAQ,CAAC;AALrB,wBAwDG"}

package/dist/api/captcha/assignDetectorBundle.js

@@ -0,0 +1,51 @@
+import { getDetectorBundlePool } from "../../tasks/detection/bundlePool.js";
+import { Tasks } from "../../tasks/tasks.js";
+import { ApiParams } from "@prosopo/types";
+import { v4 } from "uuid";
+//#region src/api/captcha/assignDetectorBundle.ts
+/**
+* Assigns a precomputed detector bundle for this detection session.
+*
+* When the provider has a non-empty pool it picks a random bundle, records the
+* (short-TTL) `detectorSessionId → bundleId` binding in Redis, and returns the
+* obfuscated detector script inline.
+*
+* When it cannot (no pool loaded, or Redis unavailable so the binding could not
+* be persisted) it returns `useProviderBundle: false`. There is NO bundled
+* detector and no legacy key pool to fall back to — the client then reports
+* `detectorUnavailable` on the frictionless hop and the provider serves a
+* challenge instead of attempting to score an absent payload.
+*/
+var assignDetectorBundle_default = (env) => async (req, res, _next) => {
+	try {
+		const noBundle = {
+			[ApiParams.useProviderBundle]: false,
+			status: "ok"
+		};
+		const pool = getDetectorBundlePool();
+		if (!pool || pool.size() === 0) return res.json(noBundle);
+		const { bundleId, bundle } = pool.pickRandom();
+		const detectorSessionId = `det-${v4()}`;
+		const writeQueue = new Tasks(env, req.logger).frictionlessManager.writeQueue;
+		if (!writeQueue) return res.json(noBundle);
+		if (!await writeQueue.cacheDetectorBundle(detectorSessionId, bundleId)) return res.json(noBundle);
+		const response = {
+			[ApiParams.useProviderBundle]: true,
+			[ApiParams.detectorSessionId]: detectorSessionId,
+			[ApiParams.detectorScript]: bundle.js,
+			status: "ok"
+		};
+		return res.json(response);
+	} catch (err) {
+		req.logger.warn(() => ({
+			msg: "assignDetectorBundle failed; falling back to bundled detector",
+			err
+		}));
+		return res.json({
+			[ApiParams.useProviderBundle]: false,
+			status: "ok"
+		});
+	}
+};
+//#endregion
+export { assignDetectorBundle_default as default };

package/dist/api/captcha/assignDetectorBundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignDetectorBundle.js","sourceRoot":"","sources":["../../../src/api/captcha/assignDetectorBundle.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAqC,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAe7C,eAAe,CAAC,GAAwB,EAAE,EAAE,CAC3C,KAAK,EACJ,GAA+B,EAC/B,GAAa,EACb,KAAmB,EACC,EAAE;IACtB,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAiC;YAC9C,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,KAAK;YACpC,MAAM,EAAE,IAAI;SACZ,CAAC;QAEF,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/C,MAAM,iBAAiB,GAAG,OAAO,MAAM,EAAE,EAAE,CAAC;QAM5C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC;QACxD,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,mBAAmB,CAClD,iBAAiB,EACjB,QAAQ,CACR,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,QAAQ,GAAiC;YAC9C,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI;YACnC,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,iBAAiB;YAChD,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,EAAE;YACrC,MAAM,EAAE,IAAI;SACZ,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAGd,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtB,GAAG,EAAE,+DAA+D;YACpE,GAAG;SACH,CAAC,CAAC,CAAC;QACJ,OAAO,GAAG,CAAC,IAAI,CAAC;YACf,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,KAAK;YACpC,MAAM,EAAE,IAAI;SAC2B,CAAC,CAAC;IAC3C,CAAC;AACF,CAAC,CAAC"}

package/dist/api/captcha/assignDetectorBundle.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=assignDetectorBundle.test.d.ts.map

package/dist/api/captcha/assignDetectorBundle.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignDetectorBundle.test.d.ts","sourceRoot":"","sources":["../../../src/api/captcha/assignDetectorBundle.test.ts"],"names":[],"mappings":""}